Windows Infrastructure Engineer / Architect

Windows Infrastructure Engineer / Architect

Location: Washington, DC

Citizenship: U.S. citizenship required

Background Requirements: Must possess or be eligible to successfully complete a Public Trust background investigation

Position Overview

We are seeking an experienced Windows Infrastructure Engineer / Architect to design, secure, scale, and support enterprise Windows infrastructure and hybrid identity platforms supporting the Federal Trade Commission (FTC).

This position serves as the subject matter expert and Tier 3 escalation point for on-premises Active Directory, Microsoft Entra ID (formerly Azure Active Directory), and Enterprise Public Key Infrastructure (PKI). The engineer will own architecture and technical standards, guide the infrastructure team, and resolve complex issues affecting security, compliance, and system availability.

The role combines architectural leadership with hands-on engineering, administration, automation, troubleshooting, and operational support.

Key Responsibilities

Architecture and Identity Management

• Design and maintain enterprise Windows infrastructure, hybrid identity solutions, and Azure environments, including Zero Trust, hybrid cloud, and cross-domain architectures.
• Serve as the technical lead and highest-level escalation point for Active Directory, Microsoft Entra ID, and related infrastructure services.
• Configure and manage centralized identity, single sign-on (SSO), and role-based access control (RBAC) across Azure tenants and subscriptions.
• Integrate federated identity solutions across Microsoft Entra ID, AWS IAM Identity Center, and on-premises Active Directory.
• Establish technical standards for infrastructure design, deployment, security, and operations.
• Support access governance, disaster recovery, and infrastructure resilience.

Security, PKI, and Azure Governance

• Design, deploy, and maintain Active Directory Certificate Services (AD CS) and enterprise PKI environments.
• Develop and enforce Azure governance frameworks using Azure Policy, Management Groups, and Blueprints, aligned with DoD Zero Trust and least-privilege principles.
• Implement system hardening, vulnerability management, and security controls aligned with CIS, STIG, FISMA, and NIST requirements.
• Monitor Azure environments and identify opportunities to improve performance, reliability, and cost efficiency.

Windows Infrastructure and Tier 3 Support

• Configure, maintain, troubleshoot, and upgrade Windows Server 2019, 2022, and 2025 environments.
• Manage physical and virtual servers in FTC data centers, including operating systems, Microsoft applications, and third-party software.
• Support hardware installation and maintenance, out-of-band management such as iLO, RAID, network adapters, SCSI, and Fibre Channel configurations.
• Resolve complex infrastructure incidents, conduct root cause analysis, and support issues escalated beyond Tier 1 and Tier 2.
• Administer Active Directory, Group Policy, DNS, DHCP, Windows permissions, and file server access control lists.
• Support server applications and security tools, including Symantec Endpoint Protection and Carbon Black Protection.

Automation and Continuous Improvement

• Develop scripts and Infrastructure as Code templates to automate provisioning, configuration, deployment, and maintenance.
• Implement configuration management and CI/CD workflows for cloud infrastructure.
• Review and improve operational processes, procedures, tools, and technical documentation.
• Complete technical projects independently and support additional server infrastructure requirements aligned with the role.

Service Management and Documentation

• Manage ServiceNow incidents, service requests, and change requests in accordance with program processes and service-level agreements.
• Maintain accurate, timely ticket updates and drive assigned issues through resolution.
• Create and maintain standard operating procedures, architecture diagrams, technical documentation, and compliance records.
• Present designs, implementation plans, courses of action, and analyses of alternatives to technical leadership and review boards.
• Prepare reports and presentations and participate in customer meetings.

Required Qualifications

• Bachelor’s degree in computer science, information systems, engineering, or a related technical field and at least 8 years of progressive Windows infrastructure engineering or architecture experience ; or a related master’s degree and at least 6 years of relevant experience . Additional relevant experience may substitute for the degree.
• At least 6 years of experience in cloud operations, cloud engineering, or a related field .
• At least 3 years in a senior or lead role , with design and architecture ownership for an enterprise Windows environment.
• Extensive experience designing, operating, and maintaining Microsoft Azure environments, including hybrid cloud, Zero Trust, and cross-domain architectures.
• Deep expertise in Active Directory, Microsoft Entra ID, Azure architecture, and integration with on-premises infrastructure.
• Experience configuring SSO, RBAC, federated identity, and cross-cloud authentication.
• Strong understanding of SAML, OpenID Connect (OIDC), and OAuth 2.0.
• Hands-on experience designing, deploying, and maintaining AD CS and PKI environments.
• Experience with Azure governance, Azure Monitor, and cloud cost optimization.
• Familiarity with federal compliance frameworks, including NIST, FISMA, and FedRAMP, and CIS 4.0 controls.
• Applied knowledge of CIS and STIG hardening, vulnerability management, and NIST SP 800-53.
• Experience administering Windows Server 2019, 2022, and 2025 and supporting physical and virtual server infrastructure.
• Strong knowledge of networking principles, including DNS, VPNs, load balancers, and cloud networking.
• Ability to script in at least one of the following: PowerShell, Python, Bash, or Visual Basic.
• Experience with Infrastructure as Code and the ability to contribute immediately to infrastructure automation.
• Familiarity with configuration management tools such as Ansible, Chef, or Puppet, and the ability to implement CI/CD pipelines for infrastructure provisioning and deployment.
• Experience creating technical and network diagrams using Visio or comparable tools.
• Experience with ITIL 4 practices and ServiceNow.
• Strong troubleshooting, root cause analysis, organizational, and problem-solving skills.
• Ability to manage technical projects independently with close attention to detail.
• Excellent written and verbal communication skills, including technical documentation and presentations to senior leadership and customers.

Required Certifications

• Microsoft Certified: Azure Administrator Associate (AZ-104).
• A current DoD 8570/8140 baseline certification appropriate for an Intermediate System Administrator role , such as Security+, GSEC, SSCP, or equivalent.

Preferred Certifications

• Additional certifications relevant to Windows infrastructure, Azure, identity management, security, or enterprise architecture.

Work Requirements

• Must be a U.S. citizen.
• Must possess or be eligible to obtain the required Public Trust suitability determination through successful completion of a background investigation.
• Must be available to provide onsite support in Washington, DC, as program needs require.
• Must be able to lift 50+ pounds.